Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

What to know

What it is

The Legal Stone application has a critical vulnerability (CVSS 9.8) due to unauthenticated PHP Object Injection, allowing an attacker to gain high privileges, read, modify or delete data, and execute arbitrary code. An attacker could exploit this vulnerability without authentication.

Affected

{'products': ['Legal Stone'], 'packages': [], 'versions': ['<= 1.2.11']}

Fix

Check the linked advisory for a fix; upgrade to a version greater than 1.2.11

Exploitation

No known exploitation